Single-tenant
Every customer runs on dedicated, physically isolated infrastructure with its own database. No shared servers, no shared tables.
No inbound ports
Your servers and gateway only open outbound connections. Nothing on your side has to accept traffic from the internet.
Encrypted everywhere
TLS in transit, encrypted disks and an encrypted database and backups at rest.
We can't see your fleet
Flying Penguin has no access to your web interface or fleet data. We see only how many gateways, users and hosts you have.
Architecture and data flow
OpsFabric has two parts: a gateway that runs inside your network, and dedicated infrastructure running your API, web interface and database, which we host and operate for you.
Arrows show who opens each connection. Your servers never accept inbound connections, and the gateway only connects outward.
- A Salt minion on each managed server connects to the gateway inside your network. The connection is started by the server, so no inbound ports are opened on your managed servers.
- The gateway, which includes the Salt master, opens a single outbound TLS WebSocket connection to your dedicated infrastructure. Results stream back over that connection in real time.
- Your team uses the OpsFabric web interface on your dedicated infrastructure, signing in with SSO or local accounts.
For a deeper technical walkthrough, read How OpsFabric works.
Isolation: one customer, dedicated infrastructure
Your fleet data is a map of every unpatched CVE, open port and failed hardening rule you have. We don't think that belongs in a shared database next to other companies' data, separated by a WHERE tenant_id = ? clause.
Every OpsFabric customer gets dedicated, single-tenant infrastructure with its own database, physically isolated from every other customer. One customer's application cannot reach another customer's data. Multi-tenancy inside your instance (for MSP clients, teams or projects) stays within your own trust boundary. Read more in Why OpsFabric is single-tenant.
What OpsFabric can do on your servers
We'd rather be direct about this: the agent is a standard Salt minion, and it runs as root. It needs those privileges to do what you use OpsFabric for, like installing patches, managing firewall rules, users, services and cron jobs, and applying compliance remediation.
Because the agent is powerful, the controls around it matter. Nothing runs on your servers unless someone with the right permissions in your instance starts it:
Role-based access
RBAC decides who can view, who can change and who can run commands, per tenant.
Approval workflows
Require approval before jobs run in selected environments, such as production.
Dry runs and windows
Preview changes before applying them, and restrict changes to maintenance windows.
Dangerous-command prompts
Remote execution asks for confirmation before destructive commands run.
Full audit log
Every action is recorded: who did it, when, on which hosts, and the full result.
Open-source agent
The agent is Salt, a widely used open-source project. You can inspect exactly what it runs.
Access to the platform
- Single sign-on: SAML and OIDC, so access follows your identity provider and offboarding happens in one place.
- Role-based access control: roles and permissions per user and per tenant.
- Approval workflows for sensitive environments.
- Audit log of every user action inside the platform.
What we can and can't access
Flying Penguin operates your infrastructure, but doesn't use it:
- We have no access to your web interface and don't see your fleet data: no hostnames, packages, vulnerabilities or compliance results.
- Our internal operations platform only sees counts: how many gateways, users and hosts your instance has. We use this for operations and billing.
- Our engineers have SSH access to your dedicated servers, used only when operationally necessary.
If "we won't look" isn't enough for your organization and you need "we can't look", choose a self-hosted deployment.
Encryption and backups
- In transit: TLS for all connections to your instance. Salt traffic between servers and the gateway is encrypted by Salt (AES session keys with RSA key authentication).
- At rest: the instance disk, the database and backup files are all encrypted.
- Backups: automatic and encrypted. Every 24 hours with 7-day retention on Start; every 12 hours with 30-day retention on Pro, where frequency and retention can be adjusted.
Updates: you decide when
We continuously maintain and harden the platform. When a new version is ready, your dashboard shows a notification and you choose when to install it. We don't upgrade your instance behind your back.
The only exception is an important security fix. In that case we announce the update and agree the timing with you before we install it.
Hosting and data residency
Customer infrastructure is hosted in the European Union by default. On the Pro plan you can choose to have your infrastructure hosted in the United States or Asia-Pacific instead, at no extra cost.
Self-hosted and air-gapped
For organizations that can't send operational data to a vendor, OpsFabric runs entirely on your own infrastructure, including in air-gapped networks. In that case no data reaches us at all. Contact us to discuss it.
Privacy and GDPR
- Flying Penguin is an EU company (Split, Croatia) and processes personal data under the GDPR.
- A Data Processing Agreement (DPA) and our list of subprocessors are available on request from hello@opsfabric.io.
- Read our privacy policy.
Who's responsible
Platform security is the responsibility of our whole team. Vedran Lebo, Founder & CEO, leads engineering. The team has around 20 years of experience running production infrastructure for clients in the US and Europe. Meet the team.
Report a vulnerability
If you believe you've found a security issue in OpsFabric, email security@opsfabric.io. We read every report and will get back to you. Our security.txt has the same details.